pwned.coffeeUpdated 27 min ago

Today's specials: 13 live security incidents, brew temperature 319°C

21°100° boilingHELL

Your order is ready. So is the exploit.Decaf. Everything is fine. Really.Quiet morning. Suspiciously quiet.

Brewed for everyone. Tell us your usual
Today's specials13
Critical10
Not fully patched4
Days since the last spill1Record calm: 8 days

297 spills in 12 months

Each square is a day. Tap one to see what spilled. Heat = critical 4, high 3, medium 2, low 1, update half.

Today's specials

3 of 13 specials. Clear

  1. criticalpartial fix Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks github.com/argoproj/argo-cd/v2 (go), github.com/argoproj/argo-cd/v3 (go) ### Impact Argo CD checks an Application's AppProject before it creates resources during a sync. That check covers destination namespaces and servers, cluster-scoped resource allow and deny lists, and namespaced resource allow and deny lists, including resource names. PreDelete and PostDelete hooks skip it. When the Application is deleted, Argo CD… fixed in github.com/argoproj/argo-cd/v3 3.3.15 +3CVE-2026-774595 sources
  2. criticalpartial fix Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path @capacitor/android (npm), @capacitor/ios (npm), github.com/ionic-team/capacitor-swift-pm (swift), com.capacitorjs:core (maven) ### Impact Capacitor's WebView navigation guard validated only the **host and scheme** of a target URL, not its **path**. Because the internal HTTP proxy path (`/_capacitor_http_interceptor_`) is served at the application's own origin, a frame navigation to it was always treated as in-app navigation and allowed. Loading that path as a document caused the… fixed in @capacitor/android 6.2.2 +15CVE-2026-1039225 sources
  3. criticalpartial fix ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass github.com/ixofoundation/ixo-blockchain/v8 (go), github.com/ixofoundation/ixo-blockchain/v7 (go), github.com/ixofoundation/ixo-blockchain/v6 (go), github.com/ixofoundation/ixo-blockchain/v5 (go) +3 more Impact Type: Improper authorization leading to unauthorized movement of user funds. The x/bonds module moved funds from an address that was resolved from a DID verification method, without verifying that the resolved address belonged to the transaction signer. Affected handlers included MsgMakeOutcomePayment, MsgBuy, MsgSell, MsgSwap, and… fixed in github.com/ixofoundation/ixo-blockchain/v8 8.0.0CVE-2026-616045 sources